Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Facebook engineer abused access to user data to track down woman

businessinsider.com.au

Post reply on HN
Print view View original

31–40 of 108 posts

Re: A Facebook engineer abused access to user data to track down woman

#31

Post by _jal »

pm90 wrote: post #16

Totally unsurprised by this. Where I used to work, user activity/transactions data sent to us would be stored on a single giant nfs volume. If you were added to a Linux group you can full, unaudited access to everything. Whenever someone tried to build anything that would restrict and audit access there would be a ton of pushback from engineers and customer support who loved being able to ssh into a machine and have…

Not uncommon in early-stage startups. I've learned to build these sorts of things with access control and auditing up-front, but certainly have built my share of attractive nuisances over time.

My advice is stub something out up front, before you go to production. You don't have time to do it right, but you do have time to establish the norm. Even if your audit trail is just a two-minute DB trigger that records that Worker Bob changed Customer Alice's password yesterday at 11, make it clear that there needs to be an articulable reason at hand for having used mechanisms that may violate users' trust.

Re: A Facebook engineer abused access to user data to track down woman

#32

Post by underseacables »

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

They had this rule at America Online when I worked there early 2000s. It was routinely violated by the managers, and was really only in place for the rank and file to cover their butts. I just assume bad management and executives of Facebook routinely violate peoples privacy by digging through their information, it’s there, and Facebook hasn’t exactly shown an interest in protecting privacy.

Re: A Facebook engineer abused access to user data to track down woman

#34

Post by sombremesa »

aaronmdjones wrote: post #5

> At the time, more than 16,000 employees had access to users’ private data, according to the book. > Stamos suggested tightening access to fewer than 5,000 employees and fewer than 100 for particularly sensitive information like passwords. I'm sorry, what? I can tell you the number of legitimate engineers that should have access to user's passwords. It's a nice, round number. It's zero.

It’s not zero. Hashed passwords are still passwords and should be treated as such. “Zero” implies that hashed passwords are not passwords, since otherwise you won’t get to zero.

Just because passwords are hashed doesn’t mean you can give access to them willy nilly and happily claim that “zero” people have password access.

Re: A Facebook engineer abused access to user data to track down woman

#35

Post by praptak »

aaronmdjones wrote: post #5

> At the time, more than 16,000 employees had access to users’ private data, according to the book. > Stamos suggested tightening access to fewer than 5,000 employees and fewer than 100 for particularly sensitive information like passwords. I'm sorry, what? I can tell you the number of legitimate engineers that should have access to user's passwords. It's a nice, round number. It's zero.

"like passwords" probably comes from the journalist and doesn't actually mean that anyone has access to passwords.

Re: A Facebook engineer abused access to user data to track down woman

#36

Post by antris »

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

>They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after.

But were you still able to just look at the data or login as the user without the permission? I think that's the key question.

Talk is cheap. As a user it's not good enough for me that people are being told internally not to abuse their access. Just remove the permissions from the employees and make them request the permissions for each individual case instead of trusting the employees to follow the rules.

Re: A Facebook engineer abused access to user data to track down woman

#37

Post by asdfasgasdgasdg »

emtel wrote: post #15

I worked at Facebook for most of 2017 and 2018. In the first week, they made it clear that you would be fired instantly for any improper access of user data. They further said that if you need to access any sensitive personal data, or if you need to log in as a user in order to debug a problem, you need to have approval from your manager _before_ the access, not after. Also, you are not allowed to access the data of…

I'm surprised that this stuff is audit only. At my company, at least in the past five years or so, this type of access has been forbidden to almost all employees. You need to request access to these types of systems and provide justification for why you should have it. Access is controlled on a per-system basis -- it's not blanket access. Many of the most sensitive systems have auto-expiring access for humans.

Nowadays we are seeing many systems switch to a regime where you have to get another engineer to sign off on any access to production, and your access is limited to at most 24h. This isn't merely a policy -- it is enforced by technical controls that forbid ordinary human-user access to production. I literally cannot even send an RPC to services I work with that handle private data without getting a colleague to sign off on it.

Re: A Facebook engineer abused access to user data to track down woman

#38

Post by _wolfie_ »

Guest42 wrote: post #9
aaronmdjones wrote: post #5

> At the time, more than 16,000 employees had access to users’ private data, according to the book. > Stamos suggested tightening access to fewer than 5,000 employees and fewer than 100 for particularly sensitive information like passwords. I'm sorry, what? I can tell you the number of legitimate engineers that should have access to user's passwords. It's a nice, round number. It's zero.

Is it not possible to only have the hashes or does it have to get persisted somewhere in the process?

Usually it's in the logs. So small number of SREs can sometimes access them (if there are logged). And even if they are not logged, they can always show up during tcpdump debugging of network issues and such.

Client side hashing could solve this, but almost no one does it.

Re: A Facebook engineer abused access to user data to track down woman

#39

Post by rwmj »

aaronmdjones wrote: post #5

> At the time, more than 16,000 employees had access to users’ private data, according to the book. > Stamos suggested tightening access to fewer than 5,000 employees and fewer than 100 for particularly sensitive information like passwords. I'm sorry, what? I can tell you the number of legitimate engineers that should have access to user's passwords. It's a nice, round number. It's zero.

Is the password sent to Facebook or does it never leave the client? (Genuine question - I have no idea how modern web apps do authentication)

Re: A Facebook engineer abused access to user data to track down woman

#40

Post by ses1984 »

aaronmdjones wrote: post #5

> At the time, more than 16,000 employees had access to users’ private data, according to the book. > Stamos suggested tightening access to fewer than 5,000 employees and fewer than 100 for particularly sensitive information like passwords. I'm sorry, what? I can tell you the number of legitimate engineers that should have access to user's passwords. It's a nice, round number. It's zero.

Could it be possible they mean access to servers where authentication is handled? If you had root access to such a server you could look at memory or packets and work towards revealing a user's password.
Post reply on HN